CVE-2017-7969

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A cross-site request forgery vulnerability exists on the Secure Gateway component of Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 and Citect Anywhere version 1.0 for multiple state-changing requests. This type of attack requires some level of social engineering in order to get a legitimate user to click on or access a malicious link/site containing the CSRF attack.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Schneider Electric SE	PowerSCADA Anywhere	Version 1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2
Schneider Electric SE	Citect Anywhere	version 1.0

References

http://www.schneider-electric.com/en/download/document/SEVD-2017-173-01/Mitigation, Patch, Vendor Advisory
http://www.securityfocus.com/bid/99913Third Party Advisory, VDB Entry
https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhereIssue Tracking, Mitigation, Patch, Vendor Advisory
http://www.schneider-electric.com/en/download/document/SEVD-2017-173-01/Mitigation, Patch, Vendor Advisory
http://www.securityfocus.com/bid/99913Third Party Advisory, VDB Entry
https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9071-security-notification-citect-anywhereIssue Tracking, Mitigation, Patch, Vendor Advisory

Timeline

Published: Sep 26, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-79706.5A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 CVE-2017-79716.5A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 CVE-2017-79725.5A vulnerability exists in Schneider Electric's PowerSCADA Anywhere v1.0 redistributed with PowerSCADA Expert v8.1 and PowerSCADA Expert v8.2 CVE-2017-79739.8A SQL injection vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in which an unauthenticated CVE-2017-79749.8A path traversal information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior in w CVE-2017-79757.8Artifex jbig2dec 0.13, as used in Ghostscript, allows out-of-bounds writes because of an integer overflow in the jbig2_build_huffman_table f CVE-2017-79767.1Artifex jbig2dec 0.13 allows out-of-bounds writes and reads because of an integer overflow in the jbig2_image_compose function in jbig2_imag CVE-2017-79779.8The Screensavercc component in eLux RP before 5.5.0 allows attackers to bypass intended configuration restrictions and execute arbitrary com CVE-2017-79787.5Samsung Android devices with L(5.0/5.1), M(6.0), and N(7.x) software allow attackers to obtain sensitive information by reading a world-read CVE-2017-79797.8The cookie feature in the packet action API implementation in net/sched/act_api.c in the Linux kernel 4.11.x through 4.11-rc7 mishandles the CVE-2017-79807.8Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute CVE-2017-79818.8Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin. This occurs in the Project Wiki component becaus